The application reads a file from versionedPath without validating that the path stays within the intended public/r/{version} directory. Since fileName is extracted directly from the user-controlled URL (url.pathname.replace(/^\/r\//, '')), an attacker can use path traversal sequences like ../ to escape the directory and access arbitrary files.

Exploit scenario:

1. Attacker sends a request: GET /r/../../etc/passwd?version=v1
2. The fileName variable is set to ../../etc/passwd
3. path.join(process.cwd(), 'public', 'r', 'v1', '../../etc/passwd') resolves to {cwd}/etc/passwd (traversing up and out of the intended directory)
4. fs.readFileSync(versionedPath) reads the system's /etc/passwd file, exposing sensitive system information
5. The attacker receives the file contents in the HTTP response

Similarly, an attacker could target ../../.env to leak environment variables containing database credentials or API keys, or ../../config.json to access application secrets.

1. Import Node.js's path.normalize() and path.resolve() functions, which are already available in your path dependency.
2. Add validation to ensure fileName doesn't contain path traversal sequences before constructing the file path. Add this check after extracting fileName:

   const normalizedFileName = path.normalize(fileName).replace(/^(\.\.[\/\\])+/, '');
   if (normalizedFileName !== fileName || normalizedFileName.includes('..')) {
     res.statusCode = 400;
     res.end(JSON.stringify({ error: 'Invalid file path' }));
     return;
   }

3. Use path.resolve() to get the absolute path of your public directory base: const baseDir = path.resolve(process.cwd(), 'public', 'r', version);
4. Construct the full file path using the normalized fileName: const versionedPath = path.join(baseDir, normalizedFileName);
5. Add a security check to verify the resolved path stays within the base directory:

   const resolvedPath = path.resolve(versionedPath);
   if (!resolvedPath.startsWith(baseDir)) {
     res.statusCode = 403;
     res.end(JSON.stringify({ error: 'Access denied' }));
     return;
   }

   This prevents attackers from using sequences like ../../../etc/passwd to access files outside your registry directory.

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by express-fs-filename.

The versionedPath variable is constructed using the fileName parameter extracted from the user's URL, which comes directly from req.url without validation. An attacker can exploit this by crafting a malicious URL to traverse outside the intended public/r/ directory.

Exploit scenario:

1. Attacker sends a request: /r/../../config.json?version=v1
2. The code extracts fileName as ../../config.json from the URL pathname
3. path.join(process.cwd(), 'public', 'r', 'v1', '../../config.json') resolves to process.cwd()/config.json, escaping the intended directory
4. fs.existsSync(versionedPath) checks this attacker-controlled path
5. If the file exists, fs.readFileSync(versionedPath) reads sensitive application config files that should not be accessible

Even though the SPECIAL_FILES allowlist exists, it only blocks exact filename matches like index.json. Path traversal sequences like ../, ..\\, or encoded variants bypass this check entirely, allowing attackers to read arbitrary files within the filesystem that the Node.js process has permissions to access.

1. Import Node.js's path.normalize() and path.resolve() functions at the top of the file (these are already available from the imported path module).

2. After extracting fileName from the URL, validate and sanitize it by normalizing the path and ensuring it doesn't contain directory traversal sequences:

   const fileName = url.pathname.replace(/^\/r\//, '');
   const normalizedFileName = path.normalize(fileName).replace(/^(\.\.(\/|\\|$))+/, '');

   This removes any ../ or ..\ sequences that could allow directory traversal.

3. Create a safe base directory path using path.resolve() to get the absolute path:

   const baseDir = path.resolve(process.cwd(), 'public', 'r', version);

4. Build the full file path and resolve it to an absolute path:

   const versionedPath = path.resolve(baseDir, normalizedFileName);

5. Add a security check to verify the resolved path is still within the intended directory:

   if (!versionedPath.startsWith(baseDir)) {
     res.statusCode = 400;
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({ error: 'Invalid file path' }));
     return;
   }

   This ensures that even after path resolution, the file remains within the public/r/version/ directory and prevents access to files outside this directory.

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by express-fs-filename.